Warn user in the MR Widget about erroneous schema reports
Proposal
When parsing security reports fail, we do display an error message in the pipeline:
However, in the MR widget, we still display a success message which can be confusing:
Instead, the backend could return an error message, and we could display it to the user. Something around the lines:
Parsing SAST report failed. Check the pipeline for more information.
Also, as a side note, we already display this information in the Vulnerability Report:
Implementation plan
backend Add errors and warnings keys to the existing REST response from EE::Projects::MergeRequestsController. These should contain the same information as contained in this example GQL query, which is a simplified version of what is used on the Pipeline -> Security page when there is a parse error on the report.
query {
project(fullPath: "gitlab-org/govern/threat-insights-demos/verification-projects/verify-390200") {
pipeline(iid: 2) {
securityReportSummary {
sast {
scans {
nodes {
name
status
errors
warnings
}
}
}
}
}
}
}
{
"data": {
"project": {
"pipeline": {
"securityReportSummary": {
"sast": {
"scans": {
"nodes": [
{
"name": "sast",
"status": "REPORT_ERROR",
"errors": [
"[Schema] property '/vulnerabilities/0/identifiers' is invalid: error_type=minItems"
],
"warnings": []
}
]
}
}
}
}
}
}
}
This will need to be added to the reports comparison. The errors can be obtained from Ci::Pipeline#security_scans(&:info)
note: The warnings key is not being used for the purposes of this issue, and could be omitted at the authors discretion. It's suggested for completeness and parity with the GQL query.
Example of the REST response before and after the changes.
--- response_before.json 2023-07-25 15:21:53.273508300 +1200
+++ response_after.json 2023-07-25 15:23:04.281551124 +1200
@@ -3,5 +3,9 @@
"base_report_out_of_date": true,
"head_report_created_at": "2023-07-24T04:11:09.514Z",
"added": [],
- "fixed": []
+ "fixed": [],
+ "errors": [
+ "[Schema] property '/vulnerabilities/0/identifiers' is invalid: error_type=minItems"
+ ],
+ "warnings": []
frontend Modify the merge request widget to check for elements in the errors object in the REST response and render as per the designs above if found.


